//! 安全通信层实现（TLS 1.3 + 证书绑定）

use reqwest::{Client, Certificate};
use std::path::Path;

/// 创建安全客户端（带证书固定）
pub fn secure_client(ca_cert: &Path) -> Result<Client, SecurityError> {
    let cert = Certificate::from_pem(&fs::read(ca_cert)?)?;
    
    Client::builder()
        .use_rustls_tls()
        .add_root_certificate(cert)
        .danger_accept_invalid_certs(false)
        .build()
        .map_err(Into::into)
}

/// 带双向认证的gRPC通道
#[cfg(feature = "distributed")]
pub fn secure_grpc_channel(addr: &str) -> tonic::transport::Channel {
    tonic::transport::Channel::from_shared(addr)
        .unwrap()
        .tls_config(
            tonic::transport::ClientTlsConfig::new()
                .ca_certificate(load_root_cert())
                .identity(load_client_identity())
        )
        .connect_lazy()
}